fix: remediate npm security scan failures

.github/workflows/release.yml

@@ -162,6 +162,11 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref }}
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: npm-package
@@ -186,11 +191,7 @@ jobs:
             exit 0
           fi
           existing_version="$(npm view "${package_name}@${package_version}" version --json --silent 2>/dev/null || true)"
-          actual_version="$(node -e '
-            const version = JSON.parse(process.argv[1]);
-            if (typeof version !== "string") process.exit(1);
-            process.stdout.write(version);
-          ' "${existing_version}")"
+          actual_version="$(node scripts/npm-view-version.mjs "${existing_version}")"
           if [[ "${actual_version}" == "${package_version}" ]]; then
             echo "Verified published ${package_name}@${package_version}"
             exit 0

.github/workflows/security-scan.yml

@@ -4,8 +4,9 @@ name: security-scan
 #
 # Caller for the reusable workflow at creatornader/oss-security-scan,
 # which runs typos + gitleaks + trufflehog + osv-scanner. OSV-Scanner
-# runs on main pushes, the Sunday scheduled run, and manual dispatch.
-# It remains disabled on pull requests to keep review feedback fast.
+# runs on main pushes, the Sunday schedule, manual dispatch, and pull requests.
+# SARIF uploads from pull_request runs attach results to the PR, including for
+# Dependabot runs with read-only tokens.
 #
 # pre-commit job runs textleaks + oss-twin-check at PR time as the
 # CI-side enforcement of the local hooks in .pre-commit-config.yaml.
@@ -32,7 +33,7 @@ jobs:
     with:
       gitleaks-version: '8.30.1'
       gitleaks-config: '.gitleaks.toml'
-      run-osv-scanner: ${{ github.event_name != 'pull_request' }}
+      run-osv-scanner: true
 
   pre-commit:
     name: pre-commit (textleaks + oss-twin-check)

CHANGELOG.md

@@ -6,6 +6,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+## [0.7.8] - 2026-10-23
+
+### Security
+
+- Bump `@modelcontextprotocol/sdk` to 1.32.2, `vitest` to 5.0.5, `zod` to 4.6.7,
+  `ip-address` to 10.7.4, `fast-uri` to 3.1.8, `hono` to 4.13.11, and
+  `body-parser` to 2.4.0.
+- Run OSV scans on all pull requests, including Dependabot and fork updates.
+  SARIF results attach to the pull request and fail the check when vulnerabilities
+  remain.
+
+### Fixed
+
+- Accept npm 12 array output when verifying an already published package.
+
 ## [0.7.7] - 2026-07-30
 
 ### Fixed

CLAUDE.md

@@ -31,6 +31,8 @@ CLI, Node, and HTTPS interfaces provide access.
 - `deploy/bootstrap-runtime.sql`: Idempotent restricted runtime-login bootstrap
 - `scripts/compose-smoke.sh`: Disposable authenticated gateway and persistence proof
 - `scripts/postgres-preflight.mjs`: Disposable local PostgreSQL 15-18 contract runner
+- `scripts/npm-view-version.mjs`: Parses npm registry version responses during
+  release recovery
 - `src/postgres-production-preflight.ts`: Read-only live PostgreSQL migration preflight
 - `docs/postmortems/2026-07-08-wrapper-source-drift.md`: Incident note for wrapper/source drift
 - `docs/decisions/0001-protocol-layers-and-acknowledgment-semantics.md`: Protocol boundary and acknowledgment semantics

SECURITY.md

@@ -4,13 +4,19 @@
 
 | Version | Security updates |
 | --- | --- |
-| 0.3.x | Supported |
+| 0.7.x | Supported |
+| 0.6.x | Not supported |
+| 0.5.x | Not supported |
+| 0.4.x | Not supported |
+| 0.3.x | Not supported |
 | 0.2.x | Not supported |
 | 0.1.x | Not supported |
 | Unreleased development code | No public support guarantee |
 
 Upgrade to the latest published package before reporting a defect that may already be
 fixed. The npm package and GitHub release page are the public version authorities.
+Projects that install Agent Bridge as a dependency must update and commit their own
+lockfile. This repository's overrides do not apply to downstream npm projects.
 
 ## Release integrity